An improperly neutralized input in the Amelia booking plugin allows attackers to inject malicious SQL statements into the database query. This flaw can lead to unauthorized data exposure, alteration, or deletion, potentially compromising the confidentiality, integrity, and availability of the site’s data. The vulnerability arises from the plugin allowing special characters to be incorporated into SQL commands without proper sanitization.

WordPress sites employing the Amelia booking plugin version 2.4.10 or earlier, including all releases from t/m/s Amelia to 2.4.10. The issue is specific to the plugin component that constructs SQL statements based on user input without adequate escaping.

The CVSS score of 9.3 indicates a high severity, while the EPSS score of < 1% suggests a low yet nonzero exploitation probability. It is not listed in the CISA KEV catalog. The description indicates that attackers can exploit the flaw by sending crafted HTTP requests to the Amelia plugin’s exposed endpoints, which cause arbitrary SQL statements to be executed against the database. This could allow unauthorized reading, modification, or deletion of data in the site’s database. The vulnerability is a classic SQL injection (CWE‑89). The likely attack vector is inferred from the fact that the plugin constructs SQL queries using user input received via HTTP requests without proper sanitization.